Rootkit gangs fight for control of infected PCs
Malware that seeks and destroys other malware
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
A turf war is developing between rootkit-touting cybercrooks over control of infected PCs.
Rootkits are strains of malware designed to hide below the level of anti-virus scanners and programmed to carry out functions such as click fraud. The Russian developer of one of the more potent strains of rootkit, TDL, is supplementing his income by selling the source code for the malware to other cybercrooks via underground forums.
But one of the groups who bought the code has done its own tinkering to develop a related strain of rootkit, called ZeroAccess. As well as adding click fraud modules the second group has begun bundling functionality that uninstalls the TDL rootkit from infected machines, effectively double crossing the original TDL3 author, according to an analysis by web security firm Webroot.
"The original author of the TDL3 rootkit made two versions of TDL3. He kept the second version of the rootkit code for himself and sold the first version to the guys behind ZeroAccess," Jacques Erasmus of Webroot told El Reg.
The group who bought the TDL3 code from the original author added a module called z00clicker that allowed infected machines to be used in click fraud around 12 months ago. ZeroAccess uses an ad clicker plugin called z00clicker2. In addition, the filesystem used by both TDL and ZeroAccess are similar, another sign that the adapted version of TDL3 and ZeroAccess are related.
Adapting purchase source code is all part of software development, whether in the legitimate or underground cyber-economies. However Webroot's analysis suggests that things have turned sour between the original TDL3 and ZeroAccess groups because ZeroAccess has begun bundling functionality to remove TDL3 from infected machines with a specific module called Anti-TDL.
"TDL3 Authors sold a version of TDL3 sourcecode to ZeroAccess authors. Now ZeroAccess guys are double crossing the TDL3 author by uninstalling the TDL rootkit," Erasmus told El Reg, adding that the behaviour recalls earlier turf wars between purveyors of the ZeuS and SpyEye banking Trojans when the latter begun bundling functions to nuke instances of ZeuS from PCs it infected in order to gain sole control of compromised boxes.
ZeroAccess is spreading rapidly via cracks and keygens websites. The malware is particularly difficult to eradicate because it goes out of its way to prevent security software from running on infected machines, as illustrated by a video on YouTube made by Webroot. ®
COMMENTS
"Malware that seeks and destroys other malware"
Who said "Norton"?
"just hang around all day looking for Windows vuln stories."
You really don't have to wait more than a minute or two !
And yet, you should still care.
Dear sir,
I, too, used to use words like 'M$' and 'Windoze', long ago. While my words may be sardonic, trust me when I say that such name-calling really does not help one's cause once one hits puberty.
So you use Linux, or if you want to cement the stereotype, complete with beard and suspenders, Gnu/Linux. Congrats for you. But it still behooves one to not celebrate too early, even if you, like I, avoid Windows, because it still affects you. Every time you get spam, it's affecting you. Every time there's lag due to too many packets out there, it's affecting you. Every time some company is exploited and has your personal information, it's affecting you. Every service that you use where Windows is there, it's affecting you.
And that's why the unnecessarily smug attitude is not helpful.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
